Care and assistance required by an injured party.

Path 1—traditional career path This is a guide for those who are planning to take a traditional career path in legal practice. 1 Newly qualified (NQ) solicitor (years 0–2) Key focus: establishing technical competency, gaining practical experience and developing core professional skills. Technical legal skills People skills Case management and draftingResearching legal precedentsUnderstanding regulatory complianceBasic advocacy and negotiation Effective client communicationBuilding relationships with colleagues and clientsEffective time and workload management Business skills Financial skills Understanding firm structure and commercial awarenessIntroductory business development (networking, client engagement etc)Basic negotiation techniques Time recording and billingUnderstanding chargeable hours and fee structuresRecognising the commercial impact of your actions 2 Associate solicitor (years 3–6) Key focus: developing expertise, specialising in a legal area and increasing professional visibility within the firm. Technical legal skills People skills Advanced legal drafting and advocacyBecoming a specialist in selected legal fieldManaging complex cases with minimal supervision Mentoring junior colleaguesHandling difficult conversations professionallyBuilding strong, cross-functional client relationships Business skills Financial skills Expanding professional networkRefining negotiation tacticsStarting to develop a personal brand within the firm Understanding budgeting within a matterLearning pricing models for legal servicesFamiliarity with all relevant internal financial reports 3 Senior associate (years 7–10) Key

A two-way, voice and digital, wireless electronic communications system. PCS encompasses cordless phones, cellular mobile phone, paging systems, personal communications networks, wireless office phone systems and any other wireless electronic communications systems that allow people to place and receive voice or data calls while away from home and office.

Personal data means data relating to a living individual who can be identified from such data, either alone or with other information in the data controller’s possession. It includes opinions about, and intentions in relation to the data subject.

Under the EU GDPR or UK GDPR, a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

This Flowchart illustrates how to manage a data protection breach (including a cybersecurity breach) under the UK General Data Protection Regulation (UK GDPR). It reflects personal data breach reporting and recording requirements under the UK GDPR together with data breach management guidance issued by the Information Commission’s Office (ICO). It maps out a data breach process, providing guidance and links to relevant precedents for each stage of that process. See Precedents: Personal data breach plan, Data breach report form—internal and Data breach assessment and action plan, which guide you through each stage of this workflow. Note 1—assemble data breach team The first step is to assemble your data breach team. Consider who within the organisation would be best placed to react swiftly to the breach and who should be involved with the subsequent investigation. This will often involve input from specialists across the business such as IT, HR and compliance/legal and, in some cases, contact with external stakeholders and suppliers. Precedent: Personal data breach plan encourages you to assemble a skeleton data breach team in advance

1 Introduction 1.1 This personal data breach plan: 1.1.1 places obligations on staff to report actual or suspected personal data breaches; and 1.1.2 sets out our procedure for managing and recording actual or suspected breaches. 1.2 This plan applies to all staff[ in the UK], and to all personal data and special category personal data held by [insert organisation’s name]. This plan supplements our policies relating to [insert policies, eg data protection, information security and any other relevant policies]. 1.3 The table below explains some key terminology used in this plan: Term Meaning Personal data breach A breach of data security leading to the:—accidental or unlawful destruction of;—loss of;—alteration of;—unauthorised disclosure of; or—access to;personal data transmitted, stored or otherwise processed, eg accidental loss, destruction, theft, corruption or unauthorised disclosure of personal data. Personal data Information relating to a living individual who can be identified (directly or indirectly) from that information. Data subject The individual to whom the personal data relates. Special category personal data (sometimes known as sensitive personal data) Personal data revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membershipGenetic dataBiometric data (where used for

Definitions—to be integrated into relevant parts of the agreement Adequacy Regulation • means any valid adequacy regulation as referred to in Article 45A of the GDPR; Attached Standard Contractual Clauses • means the provisions set out in [Annex [1]] to Schedule 3; Binding Corporate Rules • means the binding corporate rules referred to in Schedule 2; Data Protection Laws • means all [applicable laws] relating to the processing, privacy and/or use of Personal Data, as applicable to either party or the Services, including the following laws to the extent applicable in the circumstances: (a) the GDPR; (b) the Data Protection Act 2018; and (c) any laws which supplement, replace, extend, re-enact, consolidate or amend any of the foregoing; GDPR • means the General Data Protection Regulation, Regulation (EU) 2016/679 as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or a part of the United Kingdom from time to time); International Recipient • means the organisations, bodies, persons and other recipients to which Transfers of Protected Data are prohibited under clause 1.1 without the Customer’s prior written authorisation; Lawful

Definitions—to be integrated into relevant parts of the agreement Adequacy Regulation • means any valid adequacy regulation as referred to in Article 45A of the UK GDPR; Attached Standard Contractual Clauses • means the provisions set out in [Annex [1]] to Schedule 3; Binding Corporate Rules • means the binding corporate rules referred to in Schedule 2; Data Protection Laws • means, as binding on either party or the Services: (a) the GDPR; (b) the Data Protection Act 2018; and (c) any laws which supplement, replace, extend, re-enact, consolidate or amend any of the foregoing; GDPR • means the General Data Protection Regulation, Regulation (EU) 2016/679 as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or a part of the United Kingdom from time to time); International Recipient • means the organisations, bodies, persons and other recipients to which Transfers of Protected Data are prohibited under clause 1.1 without the Customer’s prior written authorisation; Lawful Safeguards • means such legally enforceable mechanism(s) for Transfers of Personal Data as may be permitted under Data Protection Laws

Produced in partnership with JP Buckley, Rachel Edwards and Andrew Mills of Shoosmiths DRAFTING FOR BREXIT: For the latest information on the impact of Brexit on the drafting, negotiation and enforceability of this Precedent, see Practice Notes: Brexit—implications for data protection, Brexit—drafting boilerplate clauses and Brexit—drafting commercial clauses. For short form pro-controller provisions drafted as a separate schedule (as opposed to clauses for the main body of the agreement), see Precedent: Personal data processing schedule—short form—pro-controller. 1 Processing of Personal Data Definitions 1.1 In this clause 1: 1.1.1 Controller, Data Subject, International Organisation, Personal Data, Personal Data Breach, Processor and processing shall have the respective meanings given to them in applicable Data Protection Laws from time to time (and related expressions, including process, processed, and processes shall be construed accordingly); 1.1.2 Data Protection Laws means any applicable law relating to the processing, privacy and/or use of Personal Data, as applicable to either party or the Services, including: (a) the GDPR; (b) the Data Protection Act 2018; (c) any laws which implement any such laws; (d) any laws that replace, extend, re-enact, consolidate

Produced in partnership with JP Buckley, Rachel Edwards and Andrew Mills of Shoosmiths DRAFTING FOR BREXIT: For the latest information on the impact of Brexit on the drafting, negotiation and enforceability of this Precedent, see Practice Notes: Brexit—implications for data protection, Brexit—drafting boilerplate clauses and Brexit—drafting commercial clauses. For short form pro-processor provisions drafted as a separate schedule (as opposed to clauses for the main body of the agreement), see Precedent: Personal data processing schedule—short form—pro-processor. 1 Processing of personal data Definitions 1.1 In this clause 1: 1.1.1 Controller, Data Subject, International Organisation, Personal Data, Personal Data Breach, Processor and processing shall have the respective meanings given to them in applicable Data Protection Laws from time to time (and related expressions, including process, processed and processes shall be construed accordingly); 1.1.2 Data Protection Laws means, as binding on either party or the Services: (a) the GDPR; (b) the Data Protection Act 2018; (c) any laws which implement

DRAFTING FOR BREXIT: For the latest information on the impact of Brexit on the drafting, negotiation and enforceability of this Precedent, see Practice Notes: Brexit—implications for data protection, Brexit—drafting boilerplate clauses and Brexit—drafting commercial clauses. [In this Agreement:] Applicable Law means: (a) any law, statute, regulation, byelaw or subordinate legislation in force from time to time to which a party is subject and/or in any jurisdiction that the Services are provided to or in respect of; (b) the common law and laws of equity as applicable to the parties from time to time; (c) any binding court order, judgment or decree; (d) [any applicable guidance, guidelines or codes of practice issued by any relevant Supervisory Authority (in each case whether or not legally binding);] (e) [any applicable industry code, policy or standard (in each case whether or not legally binding); and] (f) any applicable direction, policy, rule or order that is binding on a party and that is made or given by any regulatory body having jurisdiction over a party or any of that party’s assets, resources or business; Complaint means a complaint or request